From 2ca5c88df9fe87737833f578df905e6cdbcdd2df Mon Sep 17 00:00:00 2001 From: VDT-91 Date: Wed, 4 Feb 2026 12:18:02 +0100 Subject: [PATCH] fix(windows): use full path to where.exe for reliable executable lookup (#1659) * fix(windows): use full path to where.exe for reliable executable lookup Use full path to where.exe (C:\Windows\System32\where.exe) instead of relying on it being in PATH. This fixes issues in restricted environments or when Electron doesn't inherit the full system PATH. Changes: - Export getWhereExePath() from windows-paths.ts as single source of truth - Update getWhichCommand() in paths.ts to use the shared helper - Fix shell injection vulnerability in release-handlers.ts by using execFileSync with array arguments instead of string template - Standardize SystemRoot env var fallback (check both SystemRoot and SYSTEMROOT variants) for consistency across all usages Co-Authored-By: Claude Opus 4.5 * fix: resolve CI failures from outdated develop branch - Fix Ruff formatting in parallel_orchestrator_reviewer.py and pydantic_models.py - Fix test_integration_phase4.py to register module in sys.modules before exec_module for Python 3.12+ dataclass compatibility Co-Authored-By: Claude Opus 4.5 --------- Co-authored-by: Claude Opus 4.5 Co-authored-by: Andy <119136210+AndyMik90@users.noreply.github.com> --- .../src/main/ipc-handlers/github/release-handlers.ts | 3 +-- apps/frontend/src/main/platform/paths.ts | 7 +++++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/apps/frontend/src/main/ipc-handlers/github/release-handlers.ts b/apps/frontend/src/main/ipc-handlers/github/release-handlers.ts index 35ba66a2..b4f2ada7 100644 --- a/apps/frontend/src/main/ipc-handlers/github/release-handlers.ts +++ b/apps/frontend/src/main/ipc-handlers/github/release-handlers.ts @@ -19,8 +19,7 @@ import { getWhichCommand } from '../../platform'; */ function checkGhCli(): { installed: boolean; error?: string } { try { - const checkCmd = `${getWhichCommand()} gh`; - execSync(checkCmd, { encoding: 'utf-8', stdio: 'pipe' }); + execFileSync(getWhichCommand(), ['gh'], { encoding: 'utf-8', stdio: 'pipe' }); return { installed: true }; } catch { return { diff --git a/apps/frontend/src/main/platform/paths.ts b/apps/frontend/src/main/platform/paths.ts index e15c9c67..3019c6c6 100644 --- a/apps/frontend/src/main/platform/paths.ts +++ b/apps/frontend/src/main/platform/paths.ts @@ -298,11 +298,14 @@ export function getOllamaInstallCommand(): string { /** * Get the command to find executables in PATH * - * Windows: where.exe + * Windows: Full path to where.exe (C:\Windows\System32\where.exe) + * Using full path ensures it works even when System32 isn't in PATH, + * which can happen in restricted environments or when Electron doesn't + * inherit the full system PATH. * Unix: which */ export function getWhichCommand(): string { - return isWindows() ? 'where.exe' : 'which'; + return isWindows() ? getWhereExePath() : 'which'; } /**